> ## Documentation Index
> Fetch the complete documentation index at: https://docs.authflame.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Signals: syntax, entropy, and domain checks

> Reference for the individual signals AuthFlame returns on every email check, including syntax validation, entropy, and domain intelligence.

The `signals` object contains the raw inputs AuthFlame used to build the summary. Read it when you want to explain a decision, log detailed telemetry, or build custom rules.

## Syntax

```json theme={null}
"syntax": {
  "valid_format": true
}
```

* **`valid_format`**: `true` if the address parses cleanly (correct structure, valid characters, single `@`).

A `false` value should almost always be treated as a hard block: the address cannot receive mail as written.

## Entropy

```json theme={null}
"entropy": {
  "score": 1.5,
  "suspicious": false
}
```

* **`score`**: Shannon entropy of the local part. Higher values mean more random-looking characters.
* **`suspicious`**: `true` when the score crosses AuthFlame's threshold for auto-generated addresses.

High entropy alone is not conclusive (some real users have random usernames), but combined with a disposable domain or missing MX it's a strong bot signal.

## Domain

```json theme={null}
"domain": {
  "is_known_disposable": false,
  "is_known_free_provider": false,
  "has_mx": true,
  "is_catch_all": false,
  "is_role_account": false,
  "tld_risk_level": "low"
}
```

* **`is_known_disposable`**: matches AuthFlame's list of 15,000+ tracked disposable domains (10-minute inbox services, etc.).
* **`is_known_free_provider`**: matches a public free provider like Gmail or Outlook. Free providers are not inherently risky, but they weight other signals.
* **`has_mx`**: `true` if a live DNS lookup returned MX records. `false` means the domain cannot receive email.
* **`is_catch_all`**: `true` if the domain accepts mail for any local part. Catch-all domains reduce the value of address-level uniqueness.
* **`is_role_account`**: `true` if the local part looks like a shared inbox (`info`, `support`, `admin`, `sales`, etc.).
* **`tld_risk_level`**: `low`, `medium`, or `high`, based on abuse patterns for the top-level domain.

## Normalization

Alongside signals, every response includes a `normalized` block:

```json theme={null}
"normalized": {
  "raw": "test+promo@example.com",
  "canonical": "test@example.com",
  "local_part": "test",
  "domain": "example.com",
  "subaddress": "promo",
  "has_dots_removed": false
}
```

* **`raw`**: the address as submitted.
* **`canonical`**: the deduplicated form after stripping sub-address tags and provider-specific dot rules. Store this to detect duplicate signups.
* **`local_part`** / **`domain`**: parsed components of the canonical address.
* **`subaddress`**: the `+tag` portion, if present.
* **`has_dots_removed`**: `true` if provider-specific dot normalization changed the local part (for example, Gmail).